Privacy policy

About this policy

Stafforahr is a product of Invictronlabs, Office No. 246, Silverstone Arcade, Singanpur Road, Near Kantheriya Hanuman Mandir, Katargam, Surat – 395004, Gujarat, India ("we", "us"). This policy explains how we handle personal data on this website (stafforahr.com), the Stafforahr web app, the Stafforahr mobile app for Android and iOS, and the attendance kiosk app (together, the "Services").

We follow the Information Technology Act, 2000 and its rules, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 (the "DPDP Act").

If you have a question about this policy, email us at contact@stafforahr.com.

Who decides how your data is used

We are the Data Fiduciary for data about website visitors, people who request a demo, and the account holders of businesses that sign up.
Your employer is the Data Fiduciary for employee data in their Stafforahr account. We act as their Data Processor and use that data only to provide the Services to them.

If you are an employee and have a question or request about your attendance, leave or salary data, please contact your employer first. We will help them respond.

Data we collect

When you visit this website or ask for a demo. Pages you visit and basic device information if you allow analytics cookies (see our cookie policy). The demo form doesn't send anything to us: it opens WhatsApp with your name, mobile number, company, staff count and city filled in, and we only receive what you choose to send.

When a business creates an account. Name, email address, mobile number, password (stored as a one-way hash), company details such as GST number and address, and settings.

When an employer uses Stafforahr for its staff. Depending on the features the employer turns on:

Profile details: name, contact details, employee code, department, branch, reporting manager and joining date.
Attendance: punch times, the channel used (app, kiosk, biometric device, web or manager), breaks, shifts, leave and approvals.
Photos and face data: the selfie taken at a punch, and face templates or photos used to match a face at the kiosk or in the employee app.
Fingerprint and face logs from a connected biometric device, as sent by that device.
Location: your GPS position when you punch in or out, or start or end a field visit, checked against the areas your employer has set.
Pay: salary structure, attendance-based calculations, deductions, advances, loans, bonuses, penalties and payment records.
Statutory identifiers such as PAN, UAN, ESIC number and bank account details, and tax declarations.
Documents the employer or employee uploads, such as ID proofs and letters.
Device information used for app sign-in, notifications and offline punch sync.

When you contact support. The messages and attachments in your support ticket.

Technical data. Server logs such as IP address, browser type and the time of a request, used to keep the Services secure and working.

Permissions the mobile app asks for

The Stafforahr mobile app and the kiosk app ask for these permissions on your phone or tablet. Each one is used only for the reason given here.

Device permissions used by the Stafforahr apps
Permission	Why we ask for it	When it is used
Camera	To take your selfie when you punch in or out, and to recognise faces on the attendance kiosk	Only while you are punching
Location	To check that you are at your workplace or visit location, inside the area your employer has set	When you punch in or out, or start or end a visit
Notifications	To tell you about approvals, leave decisions, salary updates and other work alerts	When there is an update for you
Photos and files	To attach a document or photo you choose, such as an ID proof or a work report	Only when you choose to upload something

You can turn any of these off in your phone's settings. Without camera or location you may not be able to punch in from the app, and your employer can mark your attendance in another way.

Face data

Face attendance is used only if your employer turns it on. When you are enrolled, a face template is made from your photo and used only to recognise you when you punch. On the employee app the match is done on your phone. The selfie taken at each punch is saved with that attendance record so your employer can check it if there is a question.

Face data is used only for marking attendance. It is never used for advertising, and it is not shared with anyone other than the service providers who store it for us.

Sensitive personal data

Biometric information (face and fingerprint), financial information (bank account and salary details) and passwords are sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We collect these only on the employer's instructions and use them only to mark attendance and run payroll. Employers are responsible for telling their staff what is collected and why, and for getting their consent in writing where the law requires it, before turning on face, fingerprint or location features.

How we use data

To provide the Services: record attendance, apply shift, leave and policy rules, run payroll and produce payslips and reports.
To send service messages by email, in the app and on WhatsApp, such as punch alerts, leave decisions and salary-paid notices.
To verify identity and keep accounts secure, including one-time passwords for sensitive actions.
To answer support requests and demo requests.
To find and fix problems, prevent misuse and improve the Services, using aggregated data where we can.
To meet our legal obligations and respond to lawful requests from authorities.

We do not sell personal data, and we do not use employee data for advertising.

Our legal basis

We process personal data with consent under section 6 of the DPDP Act, or for a legitimate use under section 7, such as employment purposes requested by an employer or complying with a law. Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent doesn't affect processing that happened before.

We do not sell, rent or trade your data to anyone. We share it only in these cases:

With your consent.
With your employer, who owns the Stafforahr account your data is in.
With trusted service providers who help us run Stafforahr, such as cloud hosting, file storage, email and WhatsApp messaging, under strict confidentiality agreements.
With a biometric device provider, only if your employer connects their machine to Stafforahr.
To comply with the law, tax rules, court orders or valid requests from government authorities.
With a buyer or successor if our business is reorganised or sold, who must protect your data as this policy does.

Where data is stored

Personal data is stored in India (Mumbai). Some service providers may process data outside India. We only transfer data to countries not restricted by the Government of India under section 16 of the DPDP Act.

How long we keep data

We keep account and employee data while the employer's account is active, and for as long as needed to meet legal requirements such as keeping wage and statutory records.

When an account is closed, the employer can export its data. We then delete or anonymise it within 90 days, unless a law requires us to keep it longer.

How we protect data

We follow reasonable security practices under section 43A of the Information Technology Act, 2000, including encryption in transit, role-based access with permissions scoped to company, branch, department or self, a history of changes to attendance, and one-time passwords for sensitive actions. No system is perfectly secure, so please keep your password private and tell us straight away if you think your account has been misused.

Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you and how it is used (section 11);
ask us to correct, complete, update or erase it (section 12);
complain to our Grievance Officers and get a response (section 13);
nominate someone to act for you if you die or are unable to act (section 14);
withdraw any consent you have given (section 6).

To use these rights, contact our Grievance Officers below. If your request is about employee data, we will pass it to your employer and help them respond.

Deleting your account and data

If your employer gave you access, ask your company's HR or admin to remove you, or email us from the email address or mobile number linked to your account with the subject "Delete my account".
If you own a business account, you can delete your company's data from Settings in the web app, confirmed with a one-time password, or email us.

We delete the account and its personal data within 30 days of confirming the request. Records your employer must keep by law, such as wage and attendance records, are kept only for as long as the law requires and then deleted.

Step-by-step instructions are on our account deletion page.

Children

The Services are meant for businesses and adults. We don't knowingly collect personal data of anyone under 18 without verifiable consent from a parent or guardian. If you think we have, contact us and we will delete it.

Data breaches

If a personal data breach happens, we will inform the Data Protection Board of India and affected people as the DPDP Act requires, report it to CERT-In where required, and tell affected employers so they can inform their staff.

Cookies

This website uses a small number of cookies. Our cookie policy lists them and explains how to change your choices.

Grievance Officers

Invictronlabs

Email: contact@stafforahr.com
Phone: +91 90237 56238

We acknowledge every complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Changes to this policy

We may update this policy as the Services or the law change. We will update the date at the top, and tell account holders by email or in the app before any significant change takes effect.

In short